Add Composer\InstalledVersions in symbol whitelist

[a-menshchikov]

Fixes #217.

[Ocramius]

LGTM - requires feedback from author, but seems to be really good/correct fix overall.

Technical (architectural) issues were still found, and need discussion.

[Ocramius]

Overall, the approach seems much more correct now, as it correctly appends Composer\InstalledVersions to the declared "found" symbols.

The high level behavior is correct, but we're still operating in the wrong code unit.

I'm fine with merging this code as-is by adding a @TODO, but if you look above, the sources do come from:

                    $getAdditionalSourceFiles($options->getScanFiles(), dirname($composerJson)),
                    $getPackageSourceFiles($composerData, dirname($composerJson)),
                    (new LocateComposerPackageDirectDependenciesSourceFiles())->__invoke($composerJson)

I think we need to define and call $getComposerPluginApi($composerJson) in that section (by adding a parameter and a dedicated class that is only responsible for this dependency check).

What's your opinion?

[a-menshchikov]

I made some refactoring and moved code that work with composerData to the dedicated locator class.

I can't use LocateASTFromFiles and LocateDefinedSymbolsFromASTRoots for get Composer\InstalledVersions from InstalledVersions.php because it contains use Composer\Semver\VersionParser and composer/semver may not be required in composer.json. I originally thought the same as you, but have got a message about undefined symbol Composer\Semver\VersionParser.

Also I see that you write about composer-plugin-api, but I work in this PR with composer-runtime-api. Should I change code and process the both packages?

[a-menshchikov]

@Ocramius could you give me a feedback about the last comment?

[Ocramius]

This works for me and is more than sufficient, thank you! 👍

[Ocramius]

@a-menshchikov super happy with the approach taken so far, thank you so much! 👍